Coblocks Vulnerabilities

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via external iCal feed data in all versions up to, and including, 3.1.16 due to insufficient output escaping of event titles, descriptions, and locations fetched from external iCal feeds in the Events block re...

CVSS:

6.4

Affected:

up to 3.1.16

Fixed in:

3.1.17

Disclosed:

Apr 17, 2026

CVE-2026-4801 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GoDaddy CoBlocks coblocks allows Stored XSS.This issue affects CoBlocks: from n/a through <= 3.1.16.

Affected:

up to 3.1.16

Fix:

No patched version reported

Disclosed:

Feb 19, 2026

CVE-2026-27094 on NVD →

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.1.16 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbit...

CVSS:

6.4

Affected:

up to 3.1.16

Fixed in:

3.1.17

Disclosed:

Jan 7, 2026

CVE-2026-27094 on NVD →

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.1.13. This makes it possible for authenticated attackers, with Contributor-level access and above, to perform an unauthorized act...

CVSS:

4.3

Affected:

up to 3.1.13

Fixed in:

3.1.14

Disclosed:

Jan 24, 2025

CVE-2025-24751 on NVD →

[en] Missing Authorization vulnerability in GoDaddy CoBlocks allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects CoBlocks: from n/a through 3.1.13.

Affected:

up to 3.1.14

Fixed in:

3.1.14

Disclosed:

Jan 24, 2025

CVE-2025-24751 on NVD →

[en] The Page Builder Gutenberg Blocks WordPress plugin before 3.1.13 does not escape the content of post embed via one of its block, which could allow users with the capability to publish posts (editor and admin by default) to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is dis...

Affected:

up to 3.1.13

Fixed in:

3.1.13

Disclosed:

Aug 29, 2024

CVE-2024-7132 on NVD →

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via post settings in all versions up to, and including, 3.1.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level permissions and...

CVSS:

4.4

Affected:

up to 3.1.12

Fixed in:

3.1.13

Disclosed:

Aug 8, 2024

CVE-2024-7132 on NVD →

[en] The Page Builder Gutenberg Blocks WordPress plugin before 3.1.12 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks.

Affected:

up to 3.1.12

Fixed in:

3.1.12

Disclosed:

Jul 23, 2024

CVE-2024-4260 on NVD →

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.1.11. This makes it possible for authenticated attackers, with Contributor-level access and above, to make web requests to arbitrary locations originating from the web a...

CVSS:

4.3

Affected:

up to 3.1.11

Fixed in:

3.1.12

Disclosed:

Jul 2, 2024

CVE-2024-4260 on NVD →

[en] The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Social Profiles widget in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated...

Affected:

up to 3.1.10

Fixed in:

3.1.10

Disclosed:

Jun 1, 2024

CVE-2024-2933 on NVD →

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Social Profiles widget in all versions up to, and including, 3.1.9 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attac...

CVSS:

6.4

Affected:

up to 3.1.9

Fixed in:

3.1.10

Disclosed:

May 31, 2024

CVE-2024-2933 on NVD →

[en] The Page Builder Gutenberg Blocks WordPress plugin before 3.1.7 does not validate and escape some of its block options before outputting them back in a page/post where the block is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Affected:

up to 3.1.7

Fixed in:

3.1.7

Disclosed:

Apr 2, 2024

CVE-2024-2369 on NVD →

[en] The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget's in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on the link value. This makes it possible for authenticated attackers...

Affected:

up to 3.1.7

Fixed in:

3.1.7

Disclosed:

Mar 23, 2024

CVE-2024-1049 on NVD →

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget's in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on the link value. This makes it possible for authenticated attackers with...

CVSS:

6.4

Affected:

up to 3.1.6

Fixed in:

3.1.7

Disclosed:

Mar 22, 2024

CVE-2024-1049 on NVD →

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's Icon Widget's in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on the link value. This makes it possible for authenticated attackers with...

Affected:

up to 3.1.7

Fixed in:

3.1.7

Disclosed:

Mar 22, 2024

The Page Builder Gutenberg Blocks – CoBlocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's blocks in all versions up to, and including, 3.1.6 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, w...

CVSS:

6.4

Affected:

up to 3.1.6

Fixed in:

3.1.7

Disclosed:

Mar 12, 2024

CVE-2024-2369 on NVD →